wp_verify_nonce() via REST always returns false

In line 3 of your form markup, you’re passing two arguments to wp_create_nonce when it only accepts one. It’s a simple typo. You’ll want to concatenate the string like so:

wp_create_nonce( 'edit_post-'. $post->ID ) //dot instead of comma

EDIT: I’d suggest you give the nonce field a more specific name than _wpnonce, as this is the generic(default) WordPress name for nonce fields, which means you probably have a conflict with other core nonces or a plugin nonce. Maybe try something like this:

// change the NONCE name to something unique
$data .= '<input type="hidden" id="wpse263026_nonce" name="wpse263026_nonce" value="'. wp_create_nonce( 'edit_post-'. $post->ID ) .'" />';